svchost at 25% After 11/14 Patch

I am running 15063.726 and after Tuesday's patch, I get two instances of svchost.exe, one is 15 %cpu
and the other is 10% for a total of 25%. I used to just have one svchost running at 5% or 10%. Is
25% the new normal?

Arnie Goetchius wrote:
I am running 15063.726 and after Tuesday's patch, I get two instances of svchost.exe, one is 15 %cpu
and the other is 10% for a total of 25%. I used to just have one svchost running at 5% or 10%. Is
25% the new normal?

Unpack Process Explorer, right-click the EXE and
select "Run as Administrator".

https://docs.microsoft.com/en-us/sys...ocess-explorer

Find the SVCHOST which is busy, do Properties.
There should be a tab for Threads, and you can see
a name for the busy thread.

A SVCHOST can rail on one core. If you have
a four core CPU, then railing on one core
represents 25% of total CPU.

*******

You can try the Windows Update Troubleshooter in the
Control Panels :Troubleshooting. To get to the control
panel if none is evident, you can try right-clicking
the Start Orb, go to the "Run" box and enter

control return

Then find the troubleshooting panel. Then type "Update"
into the search box, upper right.

HTH,
Paul

Paul wrote:
Arnie Goetchius wrote:
I am running 15063.726 and after Tuesday's patch, I get two instances of svchost.exe, one is 15 %cpu
and the other is 10% for a total of 25%. I used to just have one svchost running at 5% or 10%. Is
25% the new normal?

Unpack Process Explorer, right-click the EXE and
select "Run as Administrator".

https://docs.microsoft.com/en-us/sys...ocess-explorer

Find the SVCHOST which is busy, do Properties.
There should be a tab for Threads, and you can see
a name for the busy thread.

A SVCHOST can rail on one core. If you have
a four core CPU, then railing on one core
represents 25% of total CPU.

*******

I get the following two on Process Explorer:

5216 9.99 930,477,704 SharedAccesssechost.dll!BuildSecurityDescriptorFor SharingAccessEx+0x6c0

9144 14.13 1,331,259,772 MpsSvc ntdll.dll!TpReleaseWork+0x2c0


You can try the Windows Update Troubleshooter in the
Control Panels :Troubleshooting. To get to the control
panel if none is evident, you can try right-clicking
the Start Orb, go to the "Run" box and enter

Â*Â* control return

Then find the troubleshooting panel. Then type "Update"
into the search box, upper right.

Getting errors in a database but finally a green check mark on three items. I think I need to spend
more time on this

FWIW, my last complete backup with Macrium Reflect was on 11/9 and I might want to do a Restore from
that.

HTH,
Â*Â* Paul

Arnie Goetchius wrote:
Paul wrote:
Arnie Goetchius wrote:
I am running 15063.726 and after Tuesday's patch, I get two instances of svchost.exe, one is 15 %cpu
and the other is 10% for a total of 25%. I used to just have one svchost running at 5% or 10%. Is
25% the new normal?
Unpack Process Explorer, right-click the EXE and
select "Run as Administrator".

https://docs.microsoft.com/en-us/sys...ocess-explorer

Find the SVCHOST which is busy, do Properties.
There should be a tab for Threads, and you can see
a name for the busy thread.

A SVCHOST can rail on one core. If you have
a four core CPU, then railing on one core
represents 25% of total CPU.

*******

I get the following two on Process Explorer:

5216 9.99 930,477,704 SharedAccesssechost.dll!BuildSecurityDescriptorFor SharingAccessEx+0x6c0

9144 14.13 1,331,259,772 MpsSvc ntdll.dll!TpReleaseWork+0x2c0

You can try the Windows Update Troubleshooter in the
Control Panels :Troubleshooting. To get to the control
panel if none is evident, you can try right-clicking
the Start Orb, go to the "Run" box and enter

control return

Then find the troubleshooting panel. Then type "Update"
into the search box, upper right.

Getting errors in a database but finally a green check mark on three items. I think I need to spend
more time on this

FWIW, my last complete backup with Macrium Reflect was on 11/9 and I might want to do a Restore from
that.
HTH,
Paul


"The Networking-MPSSVC-Svc component is part of Windows Firewall,
which protects computers by preventing unauthorized users from
gaining access through the Internet or a network."

https://blogs.technet.microsoft.com/...t-time-policy/

"Net stop MPSSVC or
net stop sharedaccesss (Depending on the OS)
"

Of course, DON'T do that. Something is banging on your firewall,
and it could be on the inside, trying to get out. Maybe
there is a dialog box, hidden behind another window,
presented by the Firewall ? Anything in Notifications sidebar ?

I smell "trouble", not just "nuisance".

If you have other computers on the subnet, you might
want to disconnect them, until you're satisfied with
the resolution. Just in case it's ransomware or something.

Paul

Arnie Goetchius wrote:
Paul wrote:
Arnie Goetchius wrote:
I am running 15063.726 and after Tuesday's patch, I get two instances of svchost.exe, one is 15 %cpu
and the other is 10% for a total of 25%. I used to just have one svchost running at 5% or 10%. Is
25% the new normal?
Unpack Process Explorer, right-click the EXE and
select "Run as Administrator".

https://docs.microsoft.com/en-us/sys...ocess-explorer

Find the SVCHOST which is busy, do Properties.
There should be a tab for Threads, and you can see
a name for the busy thread.

A SVCHOST can rail on one core. If you have
a four core CPU, then railing on one core
represents 25% of total CPU.

*******

I get the following two on Process Explorer:

5216 9.99 930,477,704 SharedAccesssechost.dll!BuildSecurityDescriptorFor SharingAccessEx+0x6c0

9144 14.13 1,331,259,772 MpsSvc ntdll.dll!TpReleaseWork+0x2c0

You can try the Windows Update Troubleshooter in the
Control Panels :Troubleshooting. To get to the control
panel if none is evident, you can try right-clicking
the Start Orb, go to the "Run" box and enter

control return

Then find the troubleshooting panel. Then type "Update"
into the search box, upper right.

Getting errors in a database but finally a green check mark on three items. I think I need to spend
more time on this

FWIW, my last complete backup with Macrium Reflect was on 11/9 and I might want to do a Restore from
that.
HTH,
Paul


The problem could be with the Windows Firewall and the
settings stored in it. Perhaps those settings were not
properly handled on the Upgrade. Peter, in a thread below
you, is seeing something similar.

Paul

Paul wrote:
Arnie Goetchius wrote:
Paul wrote:
Arnie Goetchius wrote:
I am running 15063.726 and after Tuesday's patch, I get two instances of svchost.exe, one is 15
%cpu
and the other is 10% for a total of 25%. I used to just have one svchost running at 5% or 10%. Is
25% the new normal?
Unpack Process Explorer, right-click the EXE and
select "Run as Administrator".

https://docs.microsoft.com/en-us/sys...ocess-explorer

Find the SVCHOST which is busy, do Properties.
There should be a tab for Threads, and you can see
a name for the busy thread.

A SVCHOST can rail on one core. If you have
a four core CPU, then railing on one core
represents 25% of total CPU.

*******

I get the following two on Process Explorer:

5216Â*Â*Â* 9.99Â*Â*Â* 930,477,704Â*Â*Â*
SharedAccesssechost.dll!BuildSecurityDescriptorFor SharingAccessEx+0x6c0

9144Â*Â*Â* 14.13Â*Â*Â* 1,331,259,772Â*Â*Â* MpsSvcÂ*Â*Â* ntdll.dll!TpReleaseWork+0x2c0

You can try the Windows Update Troubleshooter in the
Control Panels :Troubleshooting. To get to the control
panel if none is evident, you can try right-clicking
the Start Orb, go to the "Run" box and enter

Â*Â* control return

Then find the troubleshooting panel. Then type "Update"
into the search box, upper right.

Getting errors in a database but finally a green check mark on three items. I think I need to spend
more time on this

FWIW, my last complete backup with Macrium Reflect was on 11/9 and I might want to do a Restore from
that.
HTH,
Â*Â* Paul


The problem could be with the Windows Firewall and the
settings stored in it. Perhaps those settings were not
properly handled on the Upgrade. Peter, in a thread below
you, is seeing something similar.

Â*Â* Paul
I was running 15063.726 and I restored it before the patch of 11/14 and the problem went away. I
then restored again to after the 11/14 patch and the problem came back. Windows then upgraded me to
16299.64 and the problem still exists with it. I will follow the thread on Windows Firewall to see
if that may be the problem. Many thanks for your contribution to this issue.

Paul wrote:
Arnie Goetchius wrote:
Paul wrote:
Arnie Goetchius wrote:
I am running 15063.726 and after Tuesday's patch, I get two instances of svchost.exe, one is 15
%cpu
and the other is 10% for a total of 25%. I used to just have one svchost running at 5% or 10%. Is
25% the new normal?
Unpack Process Explorer, right-click the EXE and
select "Run as Administrator".

https://docs.microsoft.com/en-us/sys...ocess-explorer

Find the SVCHOST which is busy, do Properties.
There should be a tab for Threads, and you can see
a name for the busy thread.

A SVCHOST can rail on one core. If you have
a four core CPU, then railing on one core
represents 25% of total CPU.

*******

I get the following two on Process Explorer:

5216Â*Â*Â* 9.99Â*Â*Â* 930,477,704Â*Â*Â*
SharedAccesssechost.dll!BuildSecurityDescriptorFor SharingAccessEx+0x6c0

9144Â*Â*Â* 14.13Â*Â*Â* 1,331,259,772Â*Â*Â* MpsSvcÂ*Â*Â* ntdll.dll!TpReleaseWork+0x2c0

You can try the Windows Update Troubleshooter in the
Control Panels :Troubleshooting. To get to the control
panel if none is evident, you can try right-clicking
the Start Orb, go to the "Run" box and enter

Â*Â* control return

Then find the troubleshooting panel. Then type "Update"
into the search box, upper right.

Getting errors in a database but finally a green check mark on three items. I think I need to spend
more time on this

FWIW, my last complete backup with Macrium Reflect was on 11/9 and I might want to do a Restore from
that.
HTH,
Â*Â* Paul


The problem could be with the Windows Firewall and the
settings stored in it. Perhaps those settings were not
properly handled on the Upgrade. Peter, in a thread below
you, is seeing something similar.

Â*Â* Paul
Yes, that appears to be what happened. Went to Control Panel, Windows Defender, Restore Defaults and
that did the trick. System Idle went from 62 to 94. Phew!!